Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of specialized C# Red and Black team tools by identifying unique TypeLibGUID signatures often associated with advanced threat simulation or reconnaissance activities. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between legitimate security engineering operations and potential adversary use of similar tooling, ensuring that low-severity signals do not obscure critical threat intelligence.

YARA Rule

rule HKTL_NET_GUID_ysoserial_net {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/pwntester/ysoserial.net"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "e1e8c029-f7cd-4bd1-952e-e819b41520f0" ascii nocase wide
        $typelibguid1 = "6b40fde7-14ea-4f57-8b7b-cc2eb4a25e6c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/pwntester/ysoserial.net
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Continuous Integration servers (e.g., Jenkins, Azure DevOps) frequently compile or test .NET applications using msbuild.exe or dotnet.exe. These processes often instantiate C# assemblies that register specific TypeLibGUIDs similar to those used by Red Team tools like Cobalt Strike or BloodHound.
  • Filter/Exclusion: Exclude the process image path for known build agents (e.g., C:\Program Files\Microsoft Visual Studio\*\MSBuild\Bin\MSBuild.exe) and filter out events where the parent process is a recognized CI service account (e.g., NT SERVICE\Msbuild or specific Azure DevOps agent accounts).

• Scenario: Scheduled Endpoint Protection Health Checks

  • Context: Enterprise EDR solutions (such as CrowdStrike Falcon, SentinelOne, or Carbon Black) run scheduled C#-based diagnostic agents that query system components. These agents often load TypeLibGUIDs associated with security tooling to verify sensor health, mimicking the behavior of Blue Team tools like Sysmon or Velociraptor.
  • Filter/Exclusion: Create an exclusion based on the process name matching known EDR service executables (e.g., falcon.sys, csagent.exe) and exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these health checks are triggered.

• Scenario: Microsoft Office Add-in Initialization

  • Context: When users launch Microsoft Outlook or Excel, various third-party add-ins (such as **